Emerson Bettis GVO-C Series Instruction Manual

SIL Safety Manual
SM-025-GVO Rev. 0
November 2017
Bettis GVO-C Series Pneumatic Actuators
GVO-CLP-SR/FS SIL Safety Manual

SIL Safety Manual
SM-025-GVO Rev. 0
Table of Contents
November 2017
3
Table of Contents
Table of Contents
Section 1: Introduction
Section 2: Acronyms
Section 3: Functional Specification
Section 4: Product Description
4.1 GVO-CLP-SR/FS pneumatic linear spring return actuator general description 7
4.2 GVO-CLP-SR/FS working principle ................................................................. 8
Section 5: Service Condition Limitations (limitation of use)
Section 6: Expected Time
Section 7: Failure Modes and Estimated Failure Rates
Section 8: Periodic Text and Maintenance Requirements
8.1 General ....................................................................................................... 13
8.2 Full Stroke Test (Proof Test) ......................................................................... 13
8.3 Diagnostic Coverage / Proof Test Coverage ................................................. 15
8.4 Partial Stroke Test ....................................................................................... 16
8.5 Partial Stroke Diagnostic Coverage / Test Coverage ..................................... 19
8.6 Periodic Maintenance.................................................................................. 19
Section 9: Classification
Section 10: MRT
Section 11: Architectural Constraints
Section 12: Systematic Capability
Section 13: Manufacturer Notes

November 2017
SIL Safety Manual
SM-025-GVO Rev. 0
4
Section 1: Introduction
Introduction
Section 1: Introduction
This safety manual provides essential information necessary to design, install, verify and
maintain a Safety Instrumented Function (SIF) utilizing Emerson Actuator Series
GVO-CLP-SR/FS. This manual provides necessary requirements for meeting the IEC
61508:2010 (Sections 1 to 7) or IEC 61511 functional safety standards.

SIL Safety Manual
SM-025-GVO Rev. 0 November 2017
5
Section 2: Acronyms
Acronyms
Section 2: Acronyms
FMEDA: Failure Modes, Effects and Diagnostic Analysis
HFT: Hardware Fault Tolerance
(ref: 7.4.4 of IEC 61508-2:2010)
PFDAVG:Average Probability of dangerous Failure on Demand
(ref: 3.6.18 of IEC 61508-4:2010)
SFF: Safe Failure Fraction, property of a safety related element that is dened by
the ratio of the average failure rates of safe plus dangerous detected failures
and safe plus dangerous failures (ref: 3.6.15 of IEC 61508-4:2010)
SIF: Safety Instrumented Function, safety function with a specied safety
integrity level which is necessary to achieve functional safety and which
can be either a safety instrumented protection function or a safety
instrumented control function.
SIL: Safety Integrity Level, discrete level (one out of a possible four) for specifying
the safety integrity requirements of the safety functions to be
allocated to the E/E/PE safety related systems where Safety Integrity Level
4 has the highest level of safety integrity and Safety Integrity Level 1 has the
lowest. (ref: 3.5.8 of IEC 61508-4:2010)
SIS: Safety Instrumented System – Implementation of one or more Safety
Instrumented Functions. A SIS is composed of any combination of sensor(s),
logic solver(s), and nal element(s).

November 2017
SIL Safety Manual
SM-025-GVO Rev. 0
6
Section 3: Functional Specification
Functional Specification
Section 3: Functional Specication
The safety function performed by Emerson actuator series GVO-CLP-SR/FS is dened as
follows:
The actuator performs the safety function on demand if it delivers a full stroke driven by
the spring, moving the valve to the safe position (either closed or open depending upon
the valve to be actuated) when the system is de-energized.
The choice of the safety function to be implemented is responsibility of the system
integrator.
GVO-CLP-SR/FS actuator is intended to be part of the nal element subsystem as dened
per IEC 61508:2010. The achieved SIL level of the designed function must comply with the
project specication and must be submitted to the system integrator.
The nal control element subsystem needs to be sized properly to assure that its operating
time is equal or less than the time required to reach a safe state.
GVO-CLP-SR/FS actuator will move the valve to its safe state in equal or less than the
required SIF’s response time under the specied conditions.

SIL Safety Manual
SM-025-GVO Rev. 0 November 2017
7
Section 4: Product Description
Product Description
Section 4: Product Description
4.1 GVO-CLP-SR/FS pneumatic linear spring return
actuator general description
Emerson GVO-CLP-SR/FS low pressure pneumatic spring return linear actuator series is
engineered and is manufactured to provide fail safe operation for any linear application such
as wedge gate and through conduit gate valves, in On-Off and Modulating Heavy duty service;
simplicity, reliability and economy are at the top of the list of design parameters.
Supply pressure is maximum 12 bar-gauge, accepting air, nitrogen or sweet gas.
Supported standard ambient temperature ranges from –30°C to +100°C, special versions of
actuators are available to be used for applications outside this temperature range.
The actuator is composed of a pneumatic cylinder, a spring cartridge and a mounting pedestal
complete with a joint for the coupling to the valve stem of actuator output stem.
The valve is actuated in opening and in closing position by the actuator pneumatic cylinder in
one direction and by the spring unit in the other direction. The output thrust of spring unit can
be downward or upward according to valve operation requirements (spring to open, spring
to close, direct acting valve, reverse acting valve).
The spring return pack incorporates up to four springs, fully encapsulated in a factory welded
cartridge: this assures safety conditions to personnel and simplifies the assembly. The
linear stroke of the valve is adjustable by means of the external mechanical stop and by the
adjustment of the coupling of valve stem to actuator joint.
The actuator pedestal has a ange with threaded holes to x the actuator to the valve.
A general sectional view of the actuator is shown in Figure 1.
Emerson can supply different types of control systems, following customer’s requirements.
Figure 1 GVO-CLP-SR/FS Actuator Overview

November 2017
SIL Safety Manual
SM-025-GVO Rev. 0
8
Section 4: Product Description
Product Description
4.2 GVO-CLP-SR/FS working principle
Emerson GVO-CLP-SR/FS actuator working principle is simplied in the following Figure 2.
In the normal operating situation the operating uid (instrument air, nitrogen or sweet gas)
is supplied to the actuator’s open (close) chamber of the pneumatic cylinder: the cylinder
piston stroke causes the actuator operation and the consequent valve movement to the open
(close) operational position, and at the same time compresses the spring. Upon a demand,
the instrument air is discharged from the open (close) chamber of the cylinder: the actuator
performs the closing (opening) operation driven by the spring, and the valve moves from the
open (close) position to the close (open) position (safety-related position).
Figure 2 GVO-CLP-SR/FS actuator simplified working principle
PNEUMATIC CONNECTION

SIL Safety Manual
SM-025-GVO Rev. 0 November 2017
9
Section 5: Service Condition Limitations
Service Condition Limitations
Section 5: Service Condition Limitations
(limitation of use)
The designer of an SIF must check that the product is rated for use within the expected
application limits. The operating conditions limits strongly depend on the actuator type and
on its construction materials.
Operating pressure values are dened for each actuator.
Temperature limits are the following:
• Standard ambient temperature range: -30°C to +100°C
• Extended ambient temperature range: -60°C to +200°C (special versions)
Supply medium: instrument air, nitrogen or sweet gas (sour gas special version is available).
If GVO-CLP-SR/FS actuator is intended to be used outside the application limits or with
incompatible materials, the reliability data provided in the present document are invalid.
• The actual environmental conditions are included on the actuator nameplate
• The chose values are valid for the lifetime specied in Section 6.
• Manual override
Normally, the GVO-CLP-SR/FS actuators can be tted with one of the following types of
manual overrides:
• MHW Manual Hand-wheel mounted on the end ange of the pneumatic cylinder
• MHP Manual Hydraulic override including an additional hydraulic cylinder with
manual pump and distributor
With reference GVO-CLP-SR/FS actuator, the mechanical manual override can be done with
three conguration depending of the actuator size:
The use of a manual override is not recommended in a SIL classied application, as it results
in a bypass of the safety function.
In case the manual override is used, the following requirements must be fulllled, or the
Functional Safety Certication will become invalid:
1. The users authorized to operate on the actuator shall be skilled personnel;
2. The maximum duration of bypass shall be dened (responsibility of the nal user).
3. If necessary, compensatory measures to allow the safe operation of the process
shall be dened (responsibility of the nal user).
4. Before selecting remote operating mode control of actuator, the manual override
must be disengaged according to IOM Manual. The position selected
(remote/automatic control or local / manual control) can be achieved with a
specic technical solution that does not allow to reach an intermediate position
lever’s and avoids unintentional activation.
5. The engagement of the manual override shall be signalled, at least locally,
according to IOM Manual. As optional request from nal user, to determine if the
manual override is engaged, an electrical signal using contact switching can be
provided to communicate the status to the control room.

November 2017
SIL Safety Manual
SM-025-GVO Rev. 0
10
Section 5: Service Condition Limitations
Service Condition Limitations
Table 1.
MHW Manual Hand-wheel
MHP Manual Hydraulic
To ensure that the hand pump has been correctly disengaged after a manual override
operation, the following test shall be completed:
- restore the manual lever to remote position;
- verify the functionality performing a test from remote control (es. partial stroke test).

SIL Safety Manual
SM-025-GVO Rev. 0 November 2017
11
Section 6: Expected Lifetime
Expected Lifetime
Section 6: Expected Time
Actuators lifetime strongly depends on operating conditions and on construction
materials.
For normal service conditions the expected lifetime of Emerson GVO-CLP-SR/FS actuators
can be estimated in approximately 25 years with planned maintenance.

November 2017
SIL Safety Manual
SM-025-GVO Rev. 0
12
Section 7: Failure Modes and Estimated Failure Rates
Failure Modes and Estimated Failure Rates
Section 7: Failure Modes and Estimated
Failure Rates
A detailed Failure Mode, Effects, and Diagnostics Analysis (FMEDA) integrated with eld
feedback according to IEC 61508-2 par 7.4.4.3.3. has been carried out in order to detail all
failure rates and failure modes of GVO-CLP-SR/FS actuators.
According to D.2.2 of IEC 61508-2:2010 Annex D, the estimated failure rates of the failure
modes that result in a failure of the safety function are quoted in the following table:
Table 2. Failure modes and estimated failure rates – GVO-CLP-SR/FS actuators series
Failure mode (according to ISO 14224) Estimated failure rate [1/h]
Failure to close on demand (FTC) λD=2,21E-08
Failure to open on demand (FTO)
Notes:
- No internal diagnostic is included in the device;
- The values are valid for the lifetime specied in Section 6

SIL Safety Manual
SM-025-GVO Rev. 0 November 2017
13
Section 8: Periodic Test and Maintenance Requirements
Periodic Test and Maintenance Requirements
Section 8: Periodic Text and Maintenance
Requirements
8.1 General
Installation, commissioning and maintenance and repair works should be carried out by
qualied staff. A non-conforming assembly could be the source of serious accidents.
Please consider that the information in this paragraph are relevant only to reliability tests;
please refer to GVO-CLP-SR/FS Use and maintenance manual (Emerson document MAN
617_GVO) for detailed information about product maintenance, handling and storage.
Diagnostic tests may be executed to increase the system reliability.
“On site” tests depend on Project/Plant facilities/requirements; however, a functional test
must be executed on site, before actuator usage.
8.2 Full Stroke Test (Proof Test)
The “Full Stroke Test” (“On line”) must be performed to satisfy the PFDAVG value.
The Full Stroke Test frequency has to be dened by the nal integrator according to the
PFDAVG value to be achieved.
Full Stroke Test procedure:
1. Operate the actuator to perform No. 2 complete open/close cycles (operate the
actuator to perform a full stroke);
2. Check that the actuator operates the valve correctly and within the required operating
times (e.g. check automatically via Logic Solver the correct movement of the actuator);
3. Compare the results with the ones stored during SAT activities;
4. Record the test results in your company’s SIF database;
5. Restore the normal operation.
The procedure can be performed manually or automatically. In the following, for both
cases, the following points are listed:
• Parameters to be measured
• Instruments to be used
• Failure modes detected
• Diagnostic coverage/proof test coverage
Parameters to be measured:
The following parameters have to be measured for an effective Full Stroke Test:
• Linear position of the shaft;
• Time necessary to reach to nal position;
• Output thrust (as indirect measure, by means of the of pressure measurement in
the cylinder chamber)

November 2017
SIL Safety Manual
SM-025-GVO Rev. 0
14
Section 8: Periodic Test and Maintenance Requirements
Periodic Test and Maintenance Requirements
NOTE:
Not all parameters are needed, but the following combinations can be used:
1. Measurement of linear position as function of time (pressure measurement is optional)
2. Measurement of cylinder chamber pressure as function of time
3. Verication of nal position achievement in the established maximum time.
Table 3. Instruments / equipment to be used for the test:
Quantity Instruments / equipment
Automatic Procedure Manual Procedure
Linear position of the shaft
Case A: use of a Logic Solver:
1. Limit switches box, or
4÷20 mA position transmitter
2. Digital Input Module /
Analog Input Module
included in the Logic Solver
3. Application SW function
(to compare the actual trend
with the one stored during
SAT)
Case B: use of a PST device:
4. Limit switches box, or
4÷20 mA position transmitter
5. PST device with integrated
SW function
1. Limit switches box, with
visual indication
2. Skilled and trained
personnel
Time necessary to reach the
nal position As above 1. Chronometer 2. Skilled and trained personnel
Output thrust
(Pressure in the cylinder)
Case A: use of a Logic Solver:
1. Pressure transmitter
connected to the cylinder
chamber
2. Analog Input Module
included in the Logic Solver
3. Application SW function
(to compare the actual trend
with the one stored during
SAT)
Case B: use of a PST device:
1. Pressure transmitter
connected to the cylinder
chamber
2. PST device with integrate
SW function
Skilled and trained personnel
(to check audible partial
sticking)

SIL Safety Manual
SM-025-GVO Rev. 0 November 2017
15
Section 8: Periodic Test and Maintenance Requirements
Periodic Test and Maintenance Requirements
Table 4. Failure mode detectable by the test:
Component Detectable failure modes
Automatic Procedure Manual Procedure
Spring Cartridge
Spring
Breakage
Weakened
Worn
Sticking
As per automatic procedure
Spring Flange Breakage
Head/end ange / bolts Breakage
Unscrewing
Spring Rod Breakage
Spring Container Total Breakage
O-Rings Breakage => External leakage
Pneumatic Cylinder
Piston Sticking As per automatic procedure
Notes:
- The ones listed above are the major failure modes of the main components
- In case of manual procedure, the detectable failure modes are the same as per automatic
procedure. The test coverage is lower than the one for automatic mode, due to the human
factor.
- The manual procedure cannot be considered as diagnostic.
8.3 Diagnostic Coverage / Proof Test Coverage
Considering the application of the above described Full Stroke Test procedure, the “Test
Coverage”, in case of automatic procedure, can be considered > 99%.
In case of manual procedure the “Test Coverage” shall take into account also the test
imperfection and the reliability/competence of the operator.
NOTE:
If the test is automatic, then the Test Coverage is PTC, but can also considered as DC.
If the test is manual, then the Test Coverage is PTC, but cannot be considered as DC.

November 2017
SIL Safety Manual
SM-025-GVO Rev. 0
16
Section 8: Periodic Test and Maintenance Requirements
Periodic Test and Maintenance Requirements
8.4 Partial Stroke Test
The “Partial Stroke Test” (“On line”) can be performed to improve the PFDAVG value.
For the execution of a partial stoke test the actuator performs a partial open-close cycle
operation, typically a 15-25 degrees rotation of the valve, in order to check the correct
functioning of the actuator and the correct movement of the valve (not sticking and able
to move).
In case of GVO-CLP-SR/FS, a specic operating diagram can be used, to allow the
performing of PST without testing the pneumatic quick exhaust valve.
The PFDAVG values quoted in SIL certication document are relevant to indicated
“Partial Stroke Test” intervals.
Partial Stroke Test procedure:
1. Operate the actuator to perform N°2 partial open/close cycles, to verify the correct
functioning of the actuator/valve assembly;
2. Verify that the partial stroke manoeuvre was performed correctly and within the
expected time;
3. Inspect the actuator components for any leakages (internal and external).
The procedure can be performed manually or automatically. In the following,
for both cases, the following points are listed:
• Parameters to be measured
• Instruments to be used
• Failure modes detected
• Diagnostic coverage/proof test coverage
Parameters to be measured:
The following parameters have to be measured for an effective Partial Stroke Test:
• Linear position of the shaft;
• Time necessary to reach to nal position;
• Output torque (as indirect measure, by means of the of pressure measurement in
the cylinder chamber)
NOTE:
Not all parameters are needed, but the following combinations can be used:
1. Measurement of linear position as function of time (pressure measurement is optional)
2. Measurement of cylinder chamber pressure as function of time
3. Verication of nal position achievement in the established maximum time.

SIL Safety Manual
SM-025-GVO Rev. 0 November 2017
17
Section 8: Periodic Test and Maintenance Requirements
Periodic Test and Maintenance Requirements
The parameters to be measured depends upon the partial stroke test system available.
Instruments / equipment to be used for the test:
The Partial Stroke Test can be executed in the following way:
1. Using commercial PST device, measuring/verifying:
a. Measurement of linear position as function of time (pressure measure-
ment is optional)
b. Measurement of cylinder chamber pressure as function of time
c. Verication of nal position achievement in the established maximum
time.
2. By means of Logic Solver, measuring/verifying:
a. Measurement of linear position as function of time (pressure measure-
ment is optional)
b. Measurement of cylinder chamber pressure as function of time
c. Verication of nal position achievement in the established maximum
time.
3. By means of a manual PST system manufactured by Emerson (slightly different sys-
tems can be available: please make reference to the documentation of the specic
project)
Table 5.
Quality Instruments / equipment
Automatic Procedure Manual Procedure
Linear position of the shaft
Case A: use of a Logic Solver:
1. Limit switches box, or
4÷20 mA position transmitter
2. Digital Input Module /
Analog Input Module
included in the Logic Solver
3. Application SW function
(to compare the actual trend
with the one stored during
SAT)
Case B: use of a PST device:
4. Limit switches box, or
4÷20 mA position transmitter
5. PST device with integrate
SW function
1. Limit switches box, with
visual indication
2. Skilled and trained personnel
Time necessary to reach the
nal position As above
1. Chronometer
2. Skilled and trained personnel

November 2017
SIL Safety Manual
SM-025-GVO Rev. 0
18
Section 8: Periodic Test and Maintenance Requirements
Periodic Test and Maintenance Requirements
Output Thrust
(Pressure in the cylinder)
Case A: use of a Logic Solver:
1. Pressure transmitter
connected to the cylinder
chamber
2. Analog Input Module
included in the Logic Solver
3. Application SW function
(to compare the actual trend
with the one stored during
SAT)
Case B: use of a PST device:
1. Pressure transmitter
connected to the cylinder
chamber
2. PST device with integrate
SW function
Skilled and trained personnel
(to check audible partial
sticking)
Table 6. Failure mode detectable by the test:
Component Detectable failure modes
Automatic Procedure Manual Procedure
Spring Cartridge
Spring
Breakage
Weakened
Worn
Sticking
As per automatic procedure
Spring Flange Breakage
Head/end ange / bolts Breakage
Unscrewing
Spring Rod Breakage
Spring Container Total Breakage
O-Rings Breakage => External leakage
Pneumatic Cylinder
Piston Sticking As per automatic procedure
Notes:
- The ones listed above are the major failure modes of the main components
- In case of manual procedure, the detectable failure modes are the same as per automatic
procedure. The test coverage is lower than the one for automatic mode, due to the human
factor
- The manual procedure cannot be considered as diagnostic. The test can be considered as
“non-perfect Proof Test”, and can be considered in the estimation of PFDAVG, while it is not
considered for the estimation of SFF

SIL Safety Manual
SM-025-GVO Rev. 0 November 2017
19
Section 8: Periodic Test and Maintenance Requirements
Periodic Test and Maintenance Requirements
8.5 Partial Stroke Diagnostic Coverage / Test Coverage
Considering the application of the above described Partial Stroke Test procedure, for all
automatic methods indicated, the “Diagnostic Coverage” can be considered >90%.
In case of manual procedure the “Test Coverage” shall take into account also the test
imperfection and the reliability/competence of the operator.
8.6 Periodic Maintenance
GVO-CLP-SR/FS actuators are designed to operate long-term in heavy-duty operating
conditions, without maintenance needs. Periodicity and regularity of inspections is
particularly inuenced by specic environmental and working conditions. They can be
initially determined experimentally and then be improved according to actual maintenance
conditions and needs.
Anyway every two years of operation an inspection is required: for the relevant procedures
please refer to GVO-CLP-SR/FS Use and maintenance manual (Emerson document MAN
617_GVO Section 5).

November 2017
SIL Safety Manual
SM-025-GVO Rev. 0
20
Section 9: Classification
Classification
Section 9: Classication
GVO-CLP-SR/FS actuators are classied as Type A devices, according to 7.4.4.1.2 of IEC
61508-2:2010, for use in low demand mode applications.